SSH compromise detection using NetFlow/IPFIX

Computer Communication Review

Volumn 44, Issue 5, 2014, Pages 20-26

  Hofstede, Rick ^a   Hendriks, Luuk ^a   Sperotto, Anna ^a   Pras, Aiko ^a  

^a UNIVERSITY OF TWENTE   (Netherlands)

Author keywords

Intrusion detection; IPFIX; NetFlow; Network measurement; SSH

Indexed keywords

INTERNET PROTOCOLS; MERCURY (METAL);

DETECTION ALGORITHM; FLOW BASED; HOST-BASED; IPFIX; NETFLOWS; NETWORK MEASUREMENT; OPEN SOURCES; SCALABILITY ISSUE;

INTRUSION DETECTION;

EID: 84996843648     PISSN: 01464833     EISSN: 19435819     Source Type: Journal    
DOI: 10.1145/2677046.2677050     Document Type: Conference Paper

References (9)

1. B. Claise, B. Trammell, and P. Aitken. Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. RFC 7011 (Internet Standard), September 2013.
2. M. Drašar. Protocol-Independent Detection of Dictionary Attacks. In Proceedings of EUNICE'13, 2013.
3. L. Hellemons, L. Hendriks, R. Hofstede, A. Sperotto, R. Sadre, and A. Pras. SSHCure: A Flow-Based SSH Intrusion Detection System. In Proceedings of AIMS'12, 2012.
4. R. Hofstede, P. Čeleda, B. Trammell, I. Drago, R. Sadre, A. Sperotto, and A. Pras. Flow Monitoring Explained: From Packet Capture to Data Analysis with NetFlow and IPFIX. IEEE Communications Surveys & Tutorials, 2014.
5. M. Javed and V. Paxson. Detecting Stealthy, Distributed SSH Brute-Forcing. In Proceedings of the 2013 ACM SIGSAC conference on Computer & Communications Security, 2013.
6. A. Sperotto, R. Sadre, P.-T. de Boer, and A. Pras. Hidden Markov Model modeling of SSH brute-force attacks. In Proceedings of DSOM'09, 2009.
7. Venafi, Inc. Ponemon 2014 SSH Security Vulnerability Report. Technical report, Venafi, 2014.
8. J. Vykopal. Flow-based Brute-force Attack Detection in Large and High-speed Networks. PhD thesis, Masaryk University, Brno, Czech Republic, 2013.
9. J. Vykopal, T. Plesnik, and P. Minarik. Network-based Dictionary Attack Detection. In Proceedings of ICFN'09, 2009.